YVR Summer Software Engineering Internship

Asana reported second-quarter revenue of $216.4 million, beating analyst estimates of $214.3 million and marking 9.9% year-on-year growth. The work management platform also exceeded expectations on adjusted earnings per share, posting $0.10 versus the $0.09 consensus estimate. Despite beating expectations, Asana's stock dropped 13.7% following the announcement. The company guided next quarter's revenue to around $218 million, roughly in line with analyst forecasts, representing 8.4% year-on-year growth. Asana's operating margin improved to negative 19% from negative 25.1% in the prior-year quarter. Free cash flow margin reached 18.5%, up from 16.7% in the previous quarter. The company now has 26,778 customers paying more than $5,000 annually. Asana slightly raised its full-year revenue guidance to $861 million at the midpoint from $859.5 million.

Beyond point-in-time: continuous Offensive Security with the Cobalt API. Sep 2, 2026 Est Read Time: 6 min For enterprise security programs, the challenge was never running offensive security testing against your applications and networks. It's whether the process and results were manageable at scale and could actually drive faster remediation across every business unit and engineering team in the organization. The Cobalt API helps enterprise security programs automate work across its platform. It gives teams direct, programmatic access to pentests, findings, DAST scans, secure code reviews, and more - so security data flows into the systems where work actually gets done, without manual exports or spreadsheet hand-offs. Ensuring enterprise security results get to the proper teams Large organizations are running security testing across hundreds of assets, managed by different teams, in different business units, on different release schedules. Coordinating offensive security testing programs from a single platform is hard enough. Getting asset information into the testing platform, and then getting findings into the hands of the right engineers, tracked in the right tools, remediated and verified before the next release? That's nearly impossible. Cobalt offers native integrations into supported systems including Jira, ServiceNow, GitHub, Azure DevOps, Asana, and more, through Integration Builder, a no-code solution for building custom API-based workflows without writing or hosting scripts. But large companies have complex, multi-system workflows, and the Cobalt API gives them the flexibility to seamlessly embed Cobalt into those DevSecOps workflows, with efficiency gains across all offensive security testing initiatives. The Cobalt Platform was built to solve security challenges. The API is how it connects to everything else The Cobalt Offensive Security Platform helps enterprises move beyond point-in-time testing to a continuous offensive security program. Enhanced by AI-driven capabilities, proven methodologies, and deep security expertise, it lets you launch a pentest in hours, get real-time findings, communicate directly with testers, and push vulnerabilities straight into your remediation workflows, through one platform. For enterprise programs specifically, that means centralized control across business units, internal teams, and external vendors. A unified view of your global security posture and program schedule, benchmarked against the largest offensive security dataset in the industry. Real-time findings pushed directly to the developers who need to act on them, through the tools they already use at DevOps speed. The API extends all of that beyond the platform itself. It's how security programs build Cobalt into the workflows they've already invested in, rather than asking every team to adopt another tool. What the API makes possible The Cobalt API offers full read and write access across the platform. That means security teams aren't just pulling data out - they're managing the security testing lifecycle programmatically. Customers using the Cobalt API can create pentest briefs for submission, retrieve and filter findings, retest findings, update remediation state, link findings to external tickets, trigger and schedule DAST scans, access reports, and more. Webhooks can be configured to deliver real-time notifications for every major event - a new finding, a pentest going live, a state change, a comment - so your systems respond the moment something happens rather than waiting for a scheduled sync. Enterprise access controls are built in: SCIM, SAML/SSO, and regional data residency for US and EU customers. Getting started takes one personal API token and one organization token. The goal is for Cobalt to fit into the workflows you already have, not the other way around. Putting it into practice Here's what a few of the most common API workflows look like in code. Creating a pentest from your own systems means teams can trigger a new engagement directly from an internal tool, a CI/CD pipeline, or a security orchestration workflow. Simply use the API to specify the asset, scope, dates, and collaboration channel, and the pentest brief will be created in Cobalt. Your team needs to log in to kick off the test, and Cobalt handles review and scheduling from there. curl https://api.Cobalt.cobalt.io/pentests \ -request POST \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' \ -header 'Content-Type: application/vnd.cobalt.v2+json' \ -data '{ "asset_id": "as_TCopTvR3DZassjnKyyo3o9", "title": "Q3 Web Application Pentest", "description": "Full coverage test of the checkout flow and API endpoints", "technology_stack": "React frontend, Node.js API, PostgreSQL", "coverage": "standard", "start_date": "2024-08-01", "end_date": "2024-08-15", "methodology": "web", "collaboration_channel": "slack" }' Track the engagement through every lifecycle state via GET /pentests/{pentestId}, or subscribe to webhooks to get notified automatically as testing progresses. Pulling findings into Jira or ServiceNow is where most enterprise programs see the biggest efficiency gain. Rather than checking the platform manually, teams use the API to pull findings filtered by state, open the corresponding ticket in their ticketing system of choice, and register the link back in Cobalt so both systems stay synchronized. # Pull findings that need remediation curl 'https://api.us.cobalt.io/findings?state=need_fix' \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' # Link the Jira ticket back to the Cobalt finding curl https://api.Cobalt.cobalt.io/external_ticket_references \ -request POST \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' \ -header 'Content-Type: application/vnd.cobalt.v2+json' \ -data '{ "ticketing_system": "jira", "external_id": "SEC-4821", "external_url": "https://yourorg.atlassian.net/browse/SEC-4821", "title": "SQL Injection in /api/login endpoint", "finding_id": "vl_3xP2RCWWUajc3oRXmbQ4j9" }' Use "ticketing_system": "servicenow" for ServiceNow. Once linked, the ticket reference surfaces on the finding in Cobalt, giving pentesters and engineers a shared view without switching systems. Comments from Jira or ServiceNow can be synced back to the finding with full author and source attribution, keeping the audit trail intact in both places. Closing the loop after a fix is shipped is where a lot of programs lose time. Engineers fix vulnerabilities, but updating finding state back in Cobalt and getting a retest scheduled often falls through the cracks. The API makes it a single call from the deployment pipeline. # Check valid state transitions first curl 'https://api.us.cobalt.io/findings/YOUR_FINDING_ID/possible_states' \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' # Mark as ready for retest curl https://api.Cobalt.cobalt.io/findings/YOUR_FINDING_ID \ -request PATCH \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' \ -header 'Content-Type: application/vnd.cobalt.v2+json' \ -data '{ "state": "check_fix" }' Finding states map cleanly to the Cobalt platform UI: need_fix (Pending Fix), check_fix (Ready for Retest), valid_fix (Fixed), wont_fix (Accepted Risk). Every state change pushes to any linked Jira or ServiceNow ticket when webhooks are configured. For teams building more sophisticated bi-directional API integrations, the External Ticket References search endpoint lets you verify whether a Cobalt finding already has a linked ticket before creating a new one, preventing duplicates across high-volume programs managing findings at scale. curl https://api.Cobalt.cobalt.io/external_ticket_references/search \ -request POST \ -header 'Authorization: Bearer YOUR_API_TOKEN' \ -header 'X-Org-Token: YOUR_ORG_TOKEN' \ -header 'Content-Type: application/vnd.cobalt.v2+json' \ -data '{ "findings": [{"id": "vl_3xP2RCWWUajc3oRXmbQ4j9"}], "ticketing_system": "jira" }' Start building with the Cobalt API The Cobalt API is available to all customers. Full documentation, code examples in Shell, Ruby, Node.js, PHP, and Python, and an interactive API client are available at developer.cobalt.io. If you're ready to embed Cobalt into your security workflows - or evaluating whether the API fits your enterprise environment - its team is available to walk through your specific use case. View API documentation Talk to an expert Questions about the API or building custom integrations? Reach Cobalt at [email protected]. About Eugene Revzin. Eugene Revzin is the Senior Staff Product Manager at Cobalt. He graduated with a Bachelor of Science in Business Management. With over 15 years of product leadership experience, he helps bring to life Cobalt's mission to transform traditional penetration testing with the innovative Pentesting as a Service (PtaaS) platform. Eugene partners closely with engineering to maximize the customer experience on a modern security testing platform, and guides product releases within the Cobalt Offensive Security Testing Platform. More By Eugene Revzin Related readings. Never miss a story. Stay updated about Cobalt news as it happens

The AI models are the easy part. Daria-Georgiana Chiriac August 24, 2026 Getting an AI model to do something impressive takes minutes these days. A support assistant answers questions faster than a human would. An internal tool summarises in seconds what used to take someone hours to find. Product teams ship things that would have been unreasonable to attempt a few years ago, and the first version often works the same day. The most recent and relevant example of this last one is Asana's migration away from Enzyme, using Codex. OpenAI claims the work would have taken 5 years pre-AI, which is extremely questionable, though that's beside the point in fairness. Bottom line, something that Asana considered expensive and painful was done in 2 weeks by AI, cheap enough for them to be happy with it. That is the part of AI everyone can see, whereas the harder part is after the demo when you still have to turn it into proper software. AI doesn't replace the system around it. Lately there seems to be a lot of temptation (and sadly reality) where people treat the model as the product. User asks something, model thinks, model responds, done. Most real world software doesn't work like that. It has users, permissions, and real data that has to come from somewhere. Every action has very specific consequences, some things need to happen immediately, some can happen later, and some absolutely must not happen twice. In software, Celestify Ltd. call this deterministic behaviour. In contrast to AI, which is software with a probabilistic component inside it. Sometimes that component is incredibly powerful, like it can understand an email, simplify and explain something messy, pull information out of a long/boring document, write code, reason about a request, or decide which tool to use. That in itself doesn't mean that AI should be responsible for everything around it. If I already know that customer X has three unpaid invoices, I don't need GPT-5.6 to work that out for me. A simple database query tells me that already. Whereas if I need to decide whether an email is a cancellation request, an angry complaint or somebody asking for a copy of an invoice, that's a very good place for a model. The engineering judgement is knowing where the line between the two sits. Decide what doesn't need a model. Celestify Ltd. is increasingly seeing a pattern emerge as models become easier to use where everything starts getting pushed through it. A perfectly deterministic step becomes another instruction in the system prompt. Check whether the customer has an active subscription, work out which plan they're on, decide whether they're allowed to do this. Your app already knows all three answers, and you've just swapped something fast, cheap and deterministic for something slower, metered and capable of being wrong. The opposite mistake is real too, where trying to handle genuinely messy human input with 400 `if` statements isn't clever engineering either. The best AI systems are hybrid, and use normal software vs models where they each shine respectively. The fact that AI can do something does not mean it should. The demo has no idea what happens when things go wrong. The happy path is very easy to build now, which is one reason AI demos are so seductive. Give the model the right input under the right conditions and it just feels like magic! But in reality, when an app is running in production, and the model takes 40 seconds instead of 4 seconds, what happens then? When the provider returns an error halfway through a workflow, what happens then? The user clicks the button 3x more because nothing is happening, and you've just run the same £2 operation 4 times in a row. The model confidently returns malformed data, or calls the right tool with the wrong arguments, or produces an answer that is technically valid, yet completely useless. These are everyday software problems, and they have software answers: retries, timeouts, queues, validation, idempotency, fallbacks, permissions, logs and sensible UX around failure. None of that makes for an exciting demo, and it is also exactly the difference between a demo and a product. The worst failures are those that return 200 OK. Traditional software has a useful habit of breaking loudly. Something throws an exception, a request fails, an alert fires, someone swears at Datadog. AI fails beautifully instead. The API returns successfully, latency looks normal and nothing shows up in the logs. Instead the answer is just bad. Maybe a prompt changed, maybe the wrong data was retrieved, or the most likely, your customers started giving it inputs you didn't anticipate. The system can happily keep returning `200 OK` while becoming less useful every day. So monitoring AI works differently. You still care about uptime and latency, but you have to care about output quality as well. Is it answering the right question? Did it extract the right information? Would a human agree with the decision? Are users correcting it more often than they did last month? Answering those means testing real outputs, keeping examples of good and bad behaviour, evaluating changes properly and actually looking at what the system does in production. Otherwise your first quality alert is a customer emailing to say the thing has been wrong for two weeks. Then there is the small matter of the bill. AI is often hilariously cheap at prototype scale. You build something useful, run it 50x and spend £1.84. Then real people start using it. 1k users slowly become 10k users, context gets larger, you add another model call because the first one wasn't quite reliable enough, agents start calling tools, failed jobs retry, you name it. By then the economics look different. That doesn't quite make AI expensive though, because it's still absurdly cheap compared with the human work it replaces. Instead it makes cost an architectural concern, such that you should know roughly what an important workflow costs, what happens to that number at 10x the volume, and what you're getting back for the money. If an AI feature costs £4k/mo and removes £30k of work, nobody sensible should care about the £4k spend. But if it costs £4k/mo and nobody can tell whether customers would notice you switching it off, you have a different problem. The fix is boring though. Use caching, minimise model calls, reduce context where possible, use a smaller model and most importantly use code instead of inference when the answer is already known. The model won't be offended! Good engineers matter more than ever. There's an understandable question hanging over software engineers at the moment, which is "if AI can write the code, what is my job?" The answer is pretty much what it always was, which is everything around the code. Deciding what should be built. Understanding the existing system before changing it. Working out what AI should and shouldn't be responsible for. Designing the interfaces between the deterministic and probabilistic parts of the product. Making sensible security decisions. Knowing what happens when something fails. Keeping the system understandable enough that somebody can change it six months later. Working out whether an impressive technical capability solves a problem anybody actually has. And, unfortunately the most painful one at the moment, reviewing what the agents produce. Asana's Enzyme migration is a good example of that too. Engineers decided what needed to change, gave the agents an environment to work in, checked their progress and reviewed the proposed changes. AI moved the implementation boundary dramatically, but engineering judgement mattered more than ever. This is where some of the "AI replaces software engineers" conversation gets muddled. The human effort required to turn an idea into code is collapsing, but code was never the whole job. Let's build boring systems around clever models. Models will keep getting better! Six months from now they'll do things that are awkward today, and six months after that Celestify Ltd.'ll move the line again. Predicting exactly where it stops is a waste of time. What you can do is build systems that are comfortable with the change. Keep model providers replaceable where you can, keep business logic outside the prompt and make model outputs structured and validate them before trusting them. Measure quality, cost and more than ever, know who owns the feature after it launches. Basically, make the system around the model boring. Boring is good, because the clever part will change every three months. How Celestify Ltd. think about AI at Celestify. Celestify Ltd. is extremely bullish about what AI makes possible. Celestify Ltd. use it constantly, Celestify Ltd. build with it, its engineers use coding agents, and Celestify Ltd. put models into products and internal workflows where they remove crazy amounts of manual work. Celestify Ltd. is less interested in adding AI to something because somebody wants an AI feature on the roadmap. The question Celestify Ltd. start with is "what problem are we solving? which pain are we removing?" Sometimes the answer involves an agent, sometimes it involves retrieval, a model and three integrations, sometimes it involves a single skill.md file. Sometimes, it doesn't need a model at all. Making the impressive bit work is getting easier every month. Making the whole thing useful, reliable, secure and economically sensible is still the job. If you've got an AI feature in that grey area and can't tell which side of the line it sits on, it's worth working that out before you build it and Celestify Ltd. is happy to help you think it through.